Role-based Access Control Scheme Research Articles

Trust aware cryptographic role based access control scheme for secure cloud data storage

Cloud data storage lets customers store vast amounts of data cheaply on demand. Cryptographic role-based access control (RBAC) systems preserve cloud data privacy by restricting access to users. This study develops a trust model to reason about and improve data security in cryptographic RBAC cloud storage systems. The trust degrees of the user determine the access rights to the data and are performed by User Activity Monitoring Agent (UAMA). Two different misconducts of users such as access policy violation and data leakage affect the trust degree of the user, which in turn upgrades the access policy. In addition, the user has to decrypt the data for gaining information from it, which is a second line of security. The performance of trust based RBAC scheme is evaluated with respect to different parameters such as illegitimate user detection, memory consumption, data storage with retrieval time and the proposed work performs better.

Privacy-preserving multi-factor authentication and role-based access control scheme for the E-healthcare system

E-healthcare assists medical specialists in remotely collecting patient health data and providing remote health diagnoses. The roles are distributed among the system's users, contrasted between admin to data entry within certain rules and policies. Role-based access control (RBAC) is a technique of advanced access control that restricts key operations of users (addition, deletion and modification) access based on a user's role within a healthcare system. This paper proposes a privacy-preserving using RBAC and smart multi-factor authentication for the healthcare system to overcome the limitation flaw in previous schemes such as security risk tolerance, scalability and dynamism. This work relies on low-complexity cryptographic hash functions and symmetric operations to authenticate users while using an asymmetric cryptosystem based on the Schnorr digital signature lightweight operation to authenticate the administrator to provide multi-factor authentication. The administrator represents the system's core, and any his information leak could attack the entire system and its components. The proposed scheme conducted two thorough formal security proofs for the proposed work based on informal analysis and the Scyther tool. Furthermore, comparisons with other schemes reveal that the proposed scheme provides greater security features, and resisting attacks than the others while also being efficient in computing and communication costs.

Blockchain-Enabled Privacy-Preserving Access Control for Data Publishing and Sharing in the Internet of Medical Things

Recently, the rapid developments in the Internet of Medical Things (IoMT) enable smart devices to generate and transmit massive personal electronic medical records (EMRs). However, there are many sensitive attributes in an EMR, which could be accessed by external or internal unauthorized users for malicious purposes. In this article, we present a triple subject purpose-based access control (TS-PBAC) model, which is compatible with a blockchain-enabled reliable transaction network, and design an individual-centric security and privacy-preserving mechanism for access control with different purposes and roles in IoMT scenarios. Specifically, we design hierarchical purpose tree (HPT) and related policies to guarantee the legality of an external user with different purposes. To improve the privacy for sensitive attributes against an internal attacker, we design a local differential privacy (LDP)-based policy and role-based access control scheme in an edge computing paradigm to grant fine-granularity rights for authorized users. In addition, we introduce mutual evaluation metrics to evaluate data quality from a patient-and-medical-service level in an open anonymous network, only using logs kept in the blockchain. We test our approach by real-world EMRs with 100000 patients. The experimental results show that the proposed privacy-preserving scheme can better protect patient’s privacy than traditional access control policies in IoMT environments, and can make reliable and stable access control decisions between data publishers and data requesters with different purposes.

DF-RBAC: Dynamic and Fine-grained Role-Based Access Control Scheme with Smart Contract

Access control is a technology that can guarantee the security of information in network transmission, in which role-based access control is to separate the subject from the permission, and to assign the permission by distributing the corresponding role of the user. However, the traditional role-based access control scheme is generally centralized, the allocation of user’s role lacks fine granularity, and there is static in the allocation of the role and permission, which is not consistent with the distributed and dynamic network architecture nowadays. Hence, we propose a dynamic and fine-grained role-based access control model DF-RBAC, which can realize the flexible assignment of roles by resource owners and security verification of assigned roles. Further, we take advantage of blockchain technology and cryptography technology to combine with the DF-RBAC framework to achieve access to the activity log security audit function, which can ensure the security of the overall architecture. By safety and experimental analysis, our framework has proved to be feasible.

Secure Outsourced Medical Data against Unexpected Leakage with Flexible Access Control in a Cloud Storage System

The application of cloud storage system has been deployed widely in recent years. A lot of electronic medical records (EMRs) are collected and uploaded to the cloud for scalable sharing among the authority users. It is necessary to guarantee the confidentiality of EMRs and the privacy of EMR owners. To achieve this target, we summarize a series of attack behaviors in the cloud storage system and present the security model against many types of unexpected privacy leakage. Privacy of unassailed EMRs is guaranteed in this model, and the influence of privacy leakage is controlled in a certain scope. We also propose a role-based access control scheme to achieve flexible access control on these private EMRs. One can access medical records only if his/her role satisfies the defined access policy, which implies a fine-grained access control. Theoretical and experimental analyses show the efficiency of our scheme in terms of computation and communication.

A Trustworthy System with Mobile Services Facilitating the Everyday Life of a Museum

A museum is an environment where users with different needs interact with each other and museum content. The need of trustworthy digital services facilitating museum management and guidance is a necessity. Nowadays mobile devices are powerful and popular. A digital museum environment should adapt mobile services to be successful. But mobile devices suffer from security vulnerabilities. The proposed system supports trustworthy mobile services based on an extended role-based access control scheme for authorization purposes. This work investigates similar systems and modern smartphone technical capabilities, along with information collected by museum experts through interviews attempting to specify user requirements. An implementation of the proposed system is provided on the context of specific real-life scenarios addressing specific services needed by museum personnel and visitors. An evaluation follows comparing the presented system with other known museum systems having as criteria the services a system should provide to support real life tasks.

Design of Security Policy Based on User Identity Authentication Technology in Cloud Environment

Cloud computing application fields are growing, Apply Identity authentication to the cloud environment has certain limitation and particularity. How to ensure the safety of the cloud computing by the identity authentication technology is a problem that the service providers should concern and it is also difficult. CPK technology is a technology with independent intellectual property rights in China. The biggest advantage of CPK is to create a large scale key by a few resources. Identity authentication and access control is an indispensable part in cloud computing security. This thesis proposes a new access control scheme which combine the rolebased access control scheme and the public key authentication scheme. It can enhance the security of the access control model so as to improve the security of cloud computing. It may occur forgery attacks due to the large number of users in the cloud computing environment. To solve this problem, this thesis proposes a twoway authentication schemes to resist different kinds of forgery attacks. This thesis designs an experiment for the CPK authentication system on the Cloud Sim platform. The results of the simulation show that the user authentication can be effective in cloud computing environment.

A negotiation-based cooperative RBAC scheme

Owing to the application (APP) software for the mobile users are more and more increasing, there are various attacks or challenges appeared in accessing control of the cooperative multiple servers. However, the typical access control schemes are insufficient to deal with the kind of applications that allow accessing services by way of huge users or groups. Hence, we propose the cooperative RBAC (Role-based Access Control) scheme with negotiation-based hierarchical virtual role in this paper. It could manage not only one resource agent server, but also more than one multiple agent servers on the cooperation domain through negotiated virtual role or role set to access the collaboration agent servers. Furthermore, it provides a hierarchical virtual role structure allowing flexible negotiations among the multiple agent servers in this cooperation domain. Because of concentrating on easily designing the negotiation role approach with both extendable and flexible for RBAC model, it is a highly powerful solution using the innovative research and design of the hierarchical virtual role assignment for negotiation-based RBAC scheme.

CBR-based negotiation RBAC model for enhancing ubiquitous resources management

With the progress of new technologies of information management, Ubiquitous Resource Management (URM) is a dominant areas of research which requires efficient access management approaches. There have been huge challenges of controlling access to ubiquitous resources among collaborative multi-servers based on the negotiating security policies on URMs. However, the traditional access control mechanisms were insufficient to meet the requirements of role assignment management for URMs that allow accessing services via huge clients. Therefore, Ubiquitous RBAC (Role-based Access Control) with CBR (case-based reasoning) based negotiation technique is proposed in this paper. The novel RBAC scheme could efficiently manage not only one ubiquitous server, but also multiple ubiquitous servers on the cooperation domain through supporting both negotiating role assignment (NRA) task and cooperative role assignment (CRA) task in URM-platform by using a spiral negotiating process. Furthermore, it solves the difficulties in reducing the costs of ubiquitous computing resources, e.g., the role reassigned rate, handover rate, bandwidth, and power consumption, etc. Due to the ease of use and its efficiency in negotiating and managing the user-to-role as well as virtual role assignment by applying CBR approach, it is a highly powerful strategy of information management for conducting the innovative research and design for ubiquitous RBAC scheme.

Cognitive RBAC in mobile heterogeneous networks

In communication networks, a cognitive network (CN) is a new type of data network which is used to solve some of the problems that face current networks. Cognitive radio (CR) is part of a cognitive network and a smart wireless communication system. CR is conscious of its surrounding environment, and learns from the environment. It adapts its internal states by making corresponding real-time changes in certain operating parameters. In this paper, we propose a novel Cognitive RBAC (Role-Based Access Control) scheme which can be applied to Mobile Heterogeneous Networks (MHNs). The MHNs consist of mobile communication systems and Wi-Fi systems. The required new definitions for the RBAC model are proposed in this paper. They can improve the ability of conventional RBAC model to meet new challenges. In our scheme, we assume that a Cognitive Server (CS) provides and manages the permissions of services, and Network Providers support and manage a variety CRs and CNs, individually. For more efficiently managing CR and CN and meeting the large scale heterogeneous networks, we let mobile user can perceive network candidate actively to access services, in which the permissions are depending to the contract made by CS with each Network Provider. In this paper, the new generalized cognitive RBAC model and their definitions are proposed, and could be applied to new applications in a MHNs environment.

Role engineering: From design to evolution of security schemes

This paper presents a methodology to design the RBAC (Role-Based Access Control) scheme during the design phase of an Information System. Two actors, the component developer and the security administrator, will cooperate to define and set up the minimal set of roles in agreement with the application constraints and the organization constraints that guarantee the global security policy of an enterprise. In order to maintain the global coherence of the existing access control scheme, an algorithm is proposed to detect the possible inconsistencies before the integration of a new component in the Information System.

A theory for comparing the expressive power of access control models1

We present a theory for comparing the expressive power of access control models. The theory is based on simulations that preserve security properties. We perceive access control systems as state-transition systems and present two kinds of simulations, reductions and state-matching reductions. In applying the theory, we highlight four new results and discuss these results in the context of other results that can be inferred or are known. One result indicates that the access matrix scheme due to Harrison, Ruzzo and Ullman is limited in its expressive power when compared with a trust-management scheme, thereby formally establishing a conjecture from the literature. A second result is that a particular RBAC (Role-Based Access Control) scheme, ARBAC97, may be limited in its expressive power, thereby countering claims in the literature that RBAC is more expressive than DAC (Discretionary Access Control). A third result demonstrates that the ability to check for the absence of rights (in addition to the presence of rights) can cause a scheme to be more expressive. A fourth result is that a trust-management scheme is at least as expressive as RBAC with a particular administrative scheme (the URA97 component of ARBAC97).

Access control with role attribute certificates

The goal of access control is to counter the threat of unauthorized operations involving computer or communication systems. Role-based access control (RBAC) is a new paradigm for access control, different from the traditional schemes such as the capability scheme or the access control list scheme. To realize the RBAC scheme, we define role attribute certificates following a generic specification in X.509. Our certificate is a vehicle for carrying role-assignment information about a certificate subject. The certificate is certified, issued, and revoked by a central administrator, called the Role Attribute Certification Authority (RACA); as a result, the access control information conveyed in the certificate is centrally managed. The certificate is sent to application sites where the information is required for access control decisions; consequently, a scheme using this special type of attribute certificate gains the advantage of reducing communication. The drawback with this approach is that role attribute certificates must be accompanied by a public-key certificate, whose functioning depends on the existence of a public-key infrastructure (PKI).